secrets: a source is built only when a config names one

Building a source reads its own bootstrap pointers, and a dotenv file
is I/O. Resolving every declared source at config load moved that off
the first line that fills a managed variable and onto workspace
creation, so a file momentarily unreadable stopped the workspace from
being created. It also read every bootstrap source twice.